How each check works
Legit Signals runs the checks below on an address and reports what each one found, with its source and the time of the check. It never says a site is safe or a scam: no set of automatic checks can know that.
The five results
- On a warning list: Google Web Risk lists the address (or URLhaus, in our test copy).
- Warning sign: a fact that often goes with fraud. Its normal causes are always shown beside it.
- Worth knowing: a fact to weigh, which is common on honest sites too.
- No sign found: the check ran and found none of the above. Each one says what it does not show.
- Could not check: the check got no answer. This says nothing about the site.
Each result has its own shape as well as its own word, so no result depends on colour. The summary counts the checks that found a warning list or a warning sign. It is a tally, not a score: we never add different checks together.
Our grading rule: a check grades at the strictest level its evidence supports, and never stricter. Where there is a published figure, we grade against it and name it.
How many pages we read
By default we read up to 8 pages: the page you gave, the site's home page, and up to 6 pages it links to whose names include contact, about, returns, delivery, privacy or terms. Choose "Check only this link" and we read only the page you gave. We never read pages on other sites, and we do not run a page's scripts.
When you paste a whole message, your browser finds the links in it. Only the link you choose is sent to us.
Where the link goes
What we look at. We open the link from our server and follow it one step at a time, up to 10 steps. We note each address it passes through, including pages that send you on by themselves after they load.
Source. Our own request, from Cloudflare's network. The site sees our server, not you.
- No sign found: the link goes straight to the site, or only moves within the same site (for example from http to https).
- Worth knowing: the link passes through other sites first (link shorteners and email tracking do this), a page sends you on by itself, or the steps go round in a loop.
- Could not check: the site did not answer, refused us, or its name leads nowhere.
What it cannot see. What the site shows to a phone or to you. Some sites show servers a different page.
Google Web Risk
What we look at. We ask Google whether the address, and the address the link ends at, is on its lists of sites that spread harmful software or trick people into giving details.
Source. Google Web Risk, the commercial version of Google Safe Browsing. Advisory provided by Google.
- On a warning list: Google lists the address.
- No sign found: Google does not list it.
- Could not check: Google did not answer, or this copy of the site is not connected yet.
What it cannot see. A new site: lists need time to catch up. Fake shops that take money and send nothing are often on no list.
URLhaus (test copy only)
What we look at. We ask whether the address is on URLhaus, a list of links that spread harmful software.
Source. URLhaus, run by abuse.ch. We use it only in our test copy while we ask abuse.ch whether its terms allow use on this site.
- On a warning list: URLhaus lists harmful links on the address that are online now.
- Worth knowing: URLhaus listed harmful links there in the past, and none is online now.
- No sign found: URLhaus has no entry.
- Could not check: URLhaus did not answer, or this copy is not connected.
What it cannot see. Fake shops and phishing. This list is for harmful software.
Address age
What we look at. We read the date the address was registered.
Source. The registry's own record, over RDAP. We find each registry from the IANA list of RDAP servers.
- Warning sign: registered less than 32 days ago. This is the line Palo Alto Networks' Unit 42 uses for a "newly registered domain" (Unit 42, 20 August 2019).
- Worth knowing: registered less than a year (365 days) ago. This is our own line, not a published figure: we show it so you can weigh it.
- No sign found: registered a year ago or more.
- Could not check: the registry did not answer, does not publish dates we can read, or the site's address belongs to a platform such as Shopify (then the date would be the platform's).
What it cannot see. A change of owner. An old address can be sold or taken over.
Secure connection
What we look at. We note whether the site works over an encrypted connection (https) with a certificate that browsers accept.
Source. Our own request.
- Warning sign: the certificate fails, or the site works only without encryption (http).
- Worth knowing: the link uses http, but the site also works on https.
- No sign found: the site uses https with a valid certificate.
- Could not check: we could not reach the site.
What it cannot see. Who runs the site. Any site can get a certificate free, in minutes.
Past life (test copy only)
What we look at. We find when the Internet Archive first saved the address and the title of that first page. We compare it with the registration date and with any "since 1998" claim on the pages we read.
Source. The Internet Archive's Wayback Machine. We use it only in our test copy while we ask the Archive whether its terms allow use on this site.
- Worth knowing: the Archive has no copy, saved the address before its current registration (an earlier owner is possible), or its first copy is much later than a "since" year the site claims.
- No sign found: the first copy fits the rest of the record.
- Could not check: the Archive did not answer in time.
What it cannot see. Who runs the site now. Many honest businesses traded for years before they had a website.
Look-alike
What we look at. We look for a well-known brand's name in the address: the name itself, the name with letters swapped for look-alikes (such as 0 for o), the name one letter off, and letters from two alphabets mixed in one name. We also confirm when the address is one of the brand's own.
Source. Our own list of 299 brands that criminals often copy, with each brand's own addresses taken from Wikidata's "official website" record or from the brand's own pages (read 2026-10-29).
- Warning sign: the address imitates a brand's name, puts it in the words before a stranger's registered name, or uses it in a registered name less than a year old (or of unknown age) that is not one of the brand's addresses we know; or it mixes letters from two alphabets.
- Worth knowing: the brand's name is in a registered name a year old or more (big brands own many older addresses that no list holds), or it is the brand's name with an ending that is not on our list.
- No sign found: no brand name found, the address is one of the brand's own, or the link ends at one of the brand's own addresses.
What it cannot see. Copies of small or local brands that are not on our list.
Email set-up
What we look at. We read the address's mail records: whether it can receive email (MX), and whether the owner set up SPF and DMARC, which help stop others sending email in its name.
Source. Public DNS records, read through Cloudflare's DNS over HTTPS.
- Worth knowing: no mail server, or no SPF or no DMARC record.
- No sign found: a mail server with DMARC.
- Could not check: the records could not be read, or they belong to a platform.
What it cannot see. Who sends the mail. Many small, honest sites never set up DMARC.
Contact details
What we look at. On the pages we read, we look for a postal address, a phone number and an email address. We also note whether the pages sell something (prices, a basket or a checkout).
Source. The pages we read.
- Warning sign: the pages sell something and we found no postal address.
- Worth knowing: no postal address on a site that does not seem to sell anything.
- No sign found: we found a postal address.
- Could not check: we could not read the pages.
What it cannot see. Whether the details are real. An address can be copied from another business. We cannot read an address shown only as a picture.
Payment methods
What we look at. We look for the payment methods the pages mention: cards and PayPal, or bank transfer, payment apps and crypto.
Source. The pages we read, and the names of their payment pictures.
- Worth knowing: the pages mention bank transfer, a payment app or crypto, and no card or PayPal.
- No sign found: the pages mention card or PayPal payment, or no payment method at all.
What it cannot see. The checkout itself, which we cannot see. Payment logos in a footer do not prove a working card checkout.
Trust badges
What we look at. We look for seal and badge pictures (for example Norton, McAfee, Trustpilot, BBB, or "secure checkout") and whether each links to its issuer.
Source. The pages we read.
- Worth knowing: a badge picture does not link to its issuer, so nobody can check it.
- No sign found: every badge links to its issuer, or there are no badges.
What it cannot see. Badges that scripts draw, because we do not run scripts.
Social links
What we look at. We look at the links to social networks and whether each goes to a profile or only to the network's home page.
Source. The pages we read. We do not open social sites.
- Worth knowing: a social link goes to the network's home page, not to a profile.
- No sign found: the links go to profiles, or there are none.
What it cannot see. Whether a profile is real or active.
Template text
What we look at. We look for text left from a site template (such as "[Store name]" or "Lorem ipsum") and for email addresses that belong to another website.
Source. The pages we read.
- Worth knowing: template text, or another site's email address, is on a page.
- No sign found: neither found.
What it cannot see. Whether the policies are fair or followed.
What we keep
For 90 days we keep a small log of each check: the registered address only (never the full link or a pasted message), the date, each check's result and a fingerprint of the page's text. We keep no IP address. Privacy
Our own result
Our own address, legitsignals.com, was registered on 28 October 2026. So for its first 32 days our own address-age check gives it a warning sign, then "worth knowing" until it is a year old.
Changes
- 29 October 2026: first version.
Last reviewed: 29 October 2026.